ZyXEL Communications USG40 User Manual page 935

You can set the ZyWALL/USG's security policy to permit the use of asymmetrical route topology on
the network (so it does not reset the connection) although this is not recommended since allowing
asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through
the ZyWALL/USG. A better solution is to use virtual interfaces to put the ZyWALL/USG and the
backup gateway on separate subnets. See
interfaces for more information.
I cannot set up an IPSec VPN tunnel to another device.
If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the
IPSec routers. Log into both Zyxel IPSec routers and check the settings in each field methodically
and slowly. Make sure both the ZyWALL/USG and remote IPSec router have the same security
settings for the VPN tunnel. It may help to display the settings for both routers side-by-side.
Here are some general suggestions. See also
• The system log can often help to identify a configuration problem.
• If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled.
• The ZyWALL/USG and remote IPSec router must use the same authentication method to
establish the IKE SA.
• Both routers must use the same negotiation mode.
• Both routers must use the same encryption algorithm, authentication algorithm, and DH key
group.
• When using pre-shared keys, the ZyWALL/USG and the remote IPSec router must use the same
pre-shared key.
• The ZyWALL/USG's local and peer ID type and content must match the remote IPSec router's
peer and local ID type and content, respectively.
• The ZyWALL/USG and remote IPSec router must use the same active protocol.
• The ZyWALL/USG and remote IPSec router must use the same encapsulation.
• The ZyWALL/USG and remote IPSec router must use the same SPI.
• If the sites are/were previously connected using a leased line or ISDN router, physically
disconnect these devices from the network before testing your new VPN connection. The old
route may have been learnt by RIP and would take priority over the new VPN connection.
• To test whether or not a tunnel is working, ping from a computer at one site to a computer at the
other.
Before doing so, ensure that both computers have Internet access (via the IPSec routers).
• It is also helpful to have a way to look at the packets that are being sent and received by the
ZyWALL/USG and remote IPSec router (for example, by using a packet sniffer).
Check the configuration for the following ZyWALL/USG features.
• The ZyWALL/USG does not put IPSec SAs in the routing table. You must create a policy route for
each VPN tunnel. See
• Make sure the To-ZyWALL/USG security policies allow IPSec VPN traffic to the ZyWALL/USG. IKE
uses UDP port 500, AH uses IP protocol 51, and ESP uses IP protocol 50.
• The ZyWALL/USG supports UDP port 500 and UDP port 4500 for NAT traversal. If you enable this,
make sure the To-ZyWALL/USG security policies allow UDP port 4500 too.
Chapter 49 Troubleshooting
Asymmetrical Routes on page 514
Chapter 29 on page
Chapter 11 on page 359.
ZyWALL/USG Series User's Guide
935
and the chapter about
534.